CVE-2019-11842

Vulnerability

Description CVE-2019-11842 affects Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1 due to improper random number generation. This weakness makes it possible for attackers to predict Sydent authentication tokens or Synapse random IDs [1]. The root cause is the use of a predictable random number generator, which undermines the security of tokens that rely on unpredictability [2].

Exploitation

An attacker can exploit this vulnerability without any special privileges or network position, as the prediction requires only knowledge of the flawed generation algorithm or observation of previous outputs. The vulnerability is remotely exploitable, and no authentication is needed to begin the prediction attempt [2].

Impact

Successful prediction of authentication tokens could allow an attacker to impersonate legitimate users or gain unauthorized access to Matrix services. For Synapse, predicting random IDs could lead to information disclosure or session hijacking [3].

Mitigation

The vulnerability is fixed in Sydent 1.0.3 and Synapse 0.99.3.1. Users should update their installations immediately. No workarounds are available [1][2][3].